090f6f5d6429cd1c87376164e5d524619f89ac03827a3715db13ac7ad276ffb1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_60a9862a3a2319b8840cae59430f3827_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
Size 5.7MB
Sample260801-drpcbadm4v
SHA256 090f6f5d6429cd1c87376164e5d524619f89ac03827a3715db13ac7ad276ffb1
MD5 60a9862a3a2319b8840cae59430f3827
SHA1 0a9a23d954222281b72e105a373555f11f2d439e
SHA512 903bc36cb86568ecf2c7589313efc5f01156fe2aba106423966206d4dc9831458324796ae4f82aa0dc38efa897d8fee6701740c82e8b8213ebff1c31758b9f2e
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA9zpi57pJdcp79:tjDdTdMTdi9
TLSH
T1F6565A0273E88174F1B35B319E7996319A7ABC229E34D34F1394DA1D1E71690EA39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_60a9862a3a2319b8840cae59430f3827_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_60a9862a3a2319b8840cae59430f3827_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_60a9862a3a2319b8840cae59430f3827_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 12.3MB
SHA256 2003af4751f3f9824e0bd1226696e61a8e36c9193d0020f730af6ebbad850406
MD5 1c811070574c31f210d53652b5b78647
SHA1 28e88eba6f3b1ccd1743ac66c89fb86ee995f5ed
SHA512 17885116df791274f22dfd8cee63c330f1b96cafea2fdd524766982937a2c3c5b0eb14c72376365f4f1d0eb64f9c59a380a3ec98cbfd2981a0bebfb070571a98
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA9zpi57pJdcp7KzbnbTWpz1T5mFB1GWdhrrmqJjeb2j:tjDdTdMTdiKzzbqvT5wUWd5SzW
TLSH
T15BD64A1667F481F8E1BB92348E768771E6767C528E32974F03A0CA1E1F33A549D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4436-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4436-8-0x0000000000400000-0x000000000040E000-memory.dmp